# Analyzing Linux System Artifacts

Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH...

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (35398 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-08-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-system-artifacts -g -a claude-code -y`
Codex: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-system-artifacts -g -a codex -y`
Cursor: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-system-artifacts -g -a cursor -y`
Gemini CLI: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-system-artifacts -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills`

## Description

Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence mechanisms, or scoping a Linux-based breach during incident response.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Linux System Artifacts

## When to Use
- When investigating a compromised Linux server or workstation
- For identifying persistence mechanisms (cron, systemd, SSH keys)
- When tracing user activity through shell history and authentication logs
- During incident response to determine the scope of a Linux-based breach
- For detecting rootkits, backdoors, and unauthorized modifications

## Prerequisites
- Forensic image or live access to the Linux system (read-only)
- Understanding of Linux file system hierarchy (FHS)
- Knowledge of common Linux logging locations (/var/log/)
- Tools: chkrootkit, rkhunter, AIDE, auditd logs
- Familiarity with systemd, cron, and PAM configurations
- Root access for complete artifact collection

## Workflow

### Step 1: Mount and Collect System Artifacts

```bash
# Mount forensic image read-only
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/linux_evidence.dd /mnt/evidence

# Create collection directories
mkdir -p /cases/case-2024-001/linux/{logs,config,users,persistence,network}

# Collect authentication logs
cp /mnt/evidence/var/log/auth.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/secure* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/syslog* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/kern.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/audit/audit.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/wtmp /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/btmp /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/lastlog /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/faillog /cases/case-2024-001/linux/logs/

The rest: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/analyzing-linux-system-artifacts/SKILL.md